Research map / Large language models / Instruction and fine-tuning
Finding and Reactivating Post-Trained LLMs' Hidden Safety Mechanisms
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Finds that post-training masks LRMs' original safety mechanisms rather than removing them, and proposes SafeReAct, which aligns LoRA-adapted hidden representations on harmful prompts to a reasoning-pruned safe model's representations to restore safety.
Problem
Post-trained LLMs, especially large reasoning models (LRMs) distilled from DeepSeek-R1, show degraded safety compared with their base/regular models; realigning them is costly and can hurt task performance.
Approach
Safety mechanisms persist in post-trained LRMs but are masked by over-activated reasoning neurons. Pruning reasoning-related neurons (wanda set-difference) yields a safer model whose representations on harmful prompts are used as alignment targets, with a retain loss on reasoning data and LoRA on a few layers.
Key results
- SafeReAct reduces R1-8B harmful rate on JailbreakBench from 33% to 0% and AdvBench from 29% to 1%, with GSM8K 88% to 87%.
- On OpenThinker-7B, SafeReAct lowers JailbreakBench harmful rate from 43% to 0% while GSM8K drops only from 93% to 91%.
- SafeChain cuts GSM8K accuracy by roughly 20 points on LRMs (e.g., R1-8B 88% to 63%), while SafeReAct keeps reasoning within about 3 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply SafeReAct | R1-8B · JBB | harmful rate: 33% -> 0% | Helped |
| apply SafeReAct | R1-8B · AdvBench | harmful rate: 29% -> 1% | Helped |
| apply SafeReAct | R1-8B · GSM8K | accuracy: 88% -> 87% | No clear effect |
| apply SafeReAct | R1-7B · JBB | harmful rate: 45% -> 1% | Helped |
| apply SafeReAct | R1-7B · AdvBench | harmful rate: 29% -> 0% | Helped |
| apply SafeReAct | R1-7B · GSM8K | accuracy: 92% -> 91% | No clear effect |
| apply SafeReAct | OT-7B · JBB | harmful rate: 43% -> 0% | Helped |
| apply SafeReAct | OT-7B · AdvBench | harmful rate: 28% -> 0% | Helped |
| apply SafeReAct | OT-7B · GSM8K | accuracy: 93% -> 91% | Hurt |
| apply SafeReAct | R1-14B · JBB | harmful rate: 23% -> 0% | Helped |
| apply SafeReAct | R1-14B · AdvBench | harmful rate: 21% -> 1% | Helped |
| apply SafeReAct | R1-14B · GSM8K | accuracy: 94% -> 94% | No clear effect |
Surprising findings
- Pruning reasoning-related neurons alone restores safety in R1 models, indicating safety mechanisms are hidden rather than removed.
- Circuit-Breaker improves safety only on R1-8B and fails on the Qwen-based models.
Limitations
- Mechanism explanation rests on hypotheses; no theoretical or training-dynamics analysis.
- No error bars or repeated runs reported.
- Alpha affects reasoning performance notably, requiring per-model tuning on a utility set.
Experimental setup
Datasets: HarmBench LIMO UltraMedical S1K AdvBench WildJailbreak SafeChain GSM8K MATH-500 MedQA XSTest JailbreakBench
Benchmarks: JailbreakBench AdvBench XSTest GSM8K MATH-500 MedQA
Metrics: harmful rate accuracy
Baselines: Circuit-Breaker SafeChain ICD PAT SelfRemind
Builds on: Circuit Breaker Wanda pruning Representation Engineering
Closest papers by meaning
- Safe Delta: Consistently Preserving Safety when Fine-Tuning LLMs on Diverse Datasets (ICML 2025 · similarity 0.90)
- Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! (ICLR 2024 · similarity 0.90)
- RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.90)
- SG-Bench: Evaluating LLM Safety Generalization Across Diverse Tasks and Prompt Types (NeurIPS 2024 · similarity 0.90)
- Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · similarity 0.90)
- Exploring the Limits of Sub-Billion Language Model Reasoners with Open Training Recipes (ICLR 2026 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.